3 Introduction About This Document Purpose of the Document This Smartphone Applications User Guide is intended for users and describes where to download the application for your platform and how to enroll and authenticate using your smartphone in environment with NetIQ Advanced Authentication Framework deployed. Document Conventions This document uses the following conventions: Warning. This sign indicates requirements or restrictions that should be observed to prevent undesirable effects. Important notes. This sign indicates important information you need to know to use the product successfully. Notes. This sign indicates supplementary information you may need in some cases. Tips. This sign indicates recommendations. Terms are italicized, e.g.: Authenticator. Names of GUI elements such as dialogs, menu items, and buttons are put in bold type, e.g.: the Logon window. 3

5 Install Smartphone Application Use one of the links to download the application in itunes or Google Play: Authasas Smarpthone Authenticator for ios Authasas Smartphone Authenticator for Android Choose your platform to explore the technical materials regarding usage of the app: Apple ios Google Android 5

6 Usage of the app on ios Select a chapter from the list: First launch Enrollment Further launches Smartphone Authentication TOTP and Offline Authentication Manage Authenticators Forgotten PIN 6

7 First Launch 1. Use the icon to run the NetIQ Advanced Authentication application. 2. You will see a license agreement. Please read carefully and tap Accept if you accept the license agreement. 3. You will get a system message "NetIQ Advanced Authentication" Would Like to Send You Notifications. It's recommended to have the push notification enabled. Tap OK to enable the push notification. 7

8 4. You will see a message Please set Your PIN or leave it empty to turn off check. It's recommended to specify a PIN code to secure access to the app. Specify a PIN code or leave the PIN field empty and tap OK. 8

9 5. You will see the Welcome screen. 6. If your device supports Touch ID, tap Options in the bottom menu. Enable the TouchID protection option. Tap Save in the bottom menu to save the settings. 9

10 7. If you are going to enroll a TOTP authenticator (not Smartphone), you can disable the Welcome screen for ease of use. To do it disable the Show Welcome screen option in the Options. Then tap Save. 10

11 Enrollment Before starting enrollment on the smartphone app, initialize enrollment in NetIQ Advanced Authentication Self- Service Portal (Smartphone or TOTP method) or NetIQ Web Enrollment Wizard (Smartphone or OATH OTP authenticator) or NetIQ Client - Enrollment Wizard. 1. When you see a QR code on the screen, tap + button in the bottom menu of the Welcome screen. 2. Use camera of your device to capture the shown QR code. 11

12 The screen will be closed automatically when a compliant QR code is captured. If you see a red square over the QR code you are likely trying to scan a non-compliant QR code. Contact your system administrator. 3. You may enter the Account and Additional information for the authenticator. 12

13 4. Tap blank space to hide the onscreen keyboard. Then tap Save in bottom of the screen to save the authenticator. You will be switched back to the Welcome screen. 13

14 Further Launches 1. Use the icon to run the NetIQ Advanced Authentication application. 2. You will either get a Touch ID request and you will need to provide your fingerprint. Or you will need to enter a PIN code (if applicable) and then tap OK. 14

15 You will see the Welcome screen if you have successfully authenticated to use the app. 15

16 Smartphone Authentication To authenticate using the smartphone application (if your device has an internet connection), initialize the authentication on your endpoint. If push notification wasn't received within several seconds, run the application manually and authorize in it. Temporary troubles with push notifications may be related to Apple push services. Push notifications are not supported if you have a TOTP authenticator enrolled. Check the following article. 1. You will be notified with a push notification Authentication required!, if your device is locked or the smartphone application is closed. 2. Slide the notification, authorize in the app (Touch ID or PIN protection, if applicable). 16

17 3. Tap Accept button to accept the authentication request. If you didn't request the authentication tap Decline to reject the authentication request. You will see the message Accepted if you accepted the authentication request. 17

18 Or you will see the message Rejected if you rejected the authentication request. 18

19 TOTP and Offline Authentication If your device doesn't have an internet connection or you have the TOTP method (not Smartphone) enrolled follow the instruction to perform authentication. 1. On the Welcome screen tap Offline authentication button. You will see a list of enrolled authenticators. 2. Use a shown one-time password value to authenticate. If you are not able to authenticate ensure that a time on your device is synchronized. 19

20 Manage Authenticators To manage the existing authenticators follow the instruction: 1. On the Welcome screen tap Offline authentication button. 2. Slide an authenticator which you want to edit or delete to left. You will see the Edit and Delete buttons. 20

21 3. Tap Edit button if you want to edit information on the enrolled authenticator. Make required changes in the Account and Additional info fields. Tap blank space to hide the onscreen keyboard. Then tap Save to save the changes. 21

22 4. Tap Delete to remove the enrolled authenticator. You will need to confirm the action by tapping Yes. 22

23 Forgotten PIN In case of forgotten PIN you will have to reset and re-enroll the existing authenticators. 1. Tap blank space on the PIN request screen to hide the onscreen keyboard (if you see it). 2. Click the menu button to access the menu. 3. Click Yes if you agree to reset the enrolled authenticators. 23

24 24

25 Usage of the app on Android Select a chapter from the list: First launch Enrollment Further launches Smartphone Authentication TOTP and Offline Authentication Manage Authenticators Forgotten PIN 25

26 First Launch 1. Use the icon to run the NetIQ Advanced Authentication application. 2. You will see a license agreement. Please read carefully and tap ACCEPT if you accept the license agreement. 3. Set a PIN to access the app or leave it empty to turn off the PIN check. 26

27 It's recommended to specify a PIN code to secure access to the app. Specify a PIN code or leave the PIN field empty and tap OK. 4. You will see the Welcome screen. 27

28 5. If you are going to enroll a TOTP authenticator (not Smartphone), you can disable the Welcome screen for ease of use. To do it tap the menu button, select Options. In the opened settings disable the Welcome screen. Then tap Save. 28

29 Enrollment Before starting enrollment on the smartphone app, initialize enrollment in NetIQ Advanced Authentication Self- Service Portal (Smartphone or TOTP method) or NetIQ Web Enrollment Wizard (Smartphone or OATH OTP authenticator) or NetIQ Client - Enrollment Wizard. 1. When you see a QR code on the screen, tap top right menu button of the Welcome screen. 2. Tap Add button. 29

30 3. Use camera of your device to capture the shown QR code. The screen will be closed automatically when a compliant QR code is captured. 30

31 If you see a red square over the QR code you are likely trying to scan a non-compliant QR code. Contact your system administrator. 4. You may enter the Account and Additional information for the authenticator. 4. Tap Save to save the authenticator. You will be switched back to the Welcome screen. 31

32 Further Launches 1. Use the icon to run the NetIQ Advanced Authentication application. 2. You will need to enter a PIN code (if applicable) and then tap OK. You will see the Welcome screen if you have successfully authenticated to use the app. 32

33 33

34 Smartphone Authentication To authenticate using the smartphone application (if your device has an internet connection), initialize the authentication on your endpoint. If push notification wasn't received within several seconds, run the application manually and authorize in it. Temporary troubles with push notifications may be related to Google push services. Push notifications are not supported if you have a TOTP authenticator enrolled. Check the following article. 1. You will be notified with a push notification Authentication required!, if your device is locked or the smartphone application is closed. 2. Unlock the device and authorize in the app. 34

35 3. Tap ACCEPT button to accept the authentication request. If you didn't request the authentication tap DECLINE to reject the authentication request. You will see the message Accepted if you accepted the authentication request. 35

36 Or you will see the message Rejected if you rejected the authentication request. 36

37 TOTP and Offline Authentication If your device doesn't have an internet connection or you have the TOTP method (not Smartphone) enrolled follow the instruction to perform authentication. 1. On the Welcome screen tap Offline authentication button. You will see a list of enrolled authenticators. 2. Use a shown one-time password value to authenticate. If you are not able to authenticate ensure that a time on your device is synchronized. 37

38 Manage Authenticators To manage the existing authenticators follow the instruction: 1. On the Welcome screen tap OFFLINE AUTHENTICATION button. 2. Tap an authenticator which you want to edit or delete. 38

39 You will see the Change authenticator screen. 3. If you want to change Account or Additional info make the changes and then tap Save. 39

40 4. If you want to remove the authenticator, tap menu button and then tap Delete to remove the enrolled authenticator. You will need to confirm the action by tapping Yes. 40

41 Forgotten PIN In case of forgotten PIN you will have to reset and re-enroll the existing authenticators. 1. Click the menu button to access the menu. 2. Click YES if you agree to reset the enrolled authenticators. 41

42 42

43 Troubleshooting This chapter provides solutions for known issues. If you encounter any problems that are not mentioned here, please contact the support service. Enrollment can't be performed Description: Can't scan a QR code. Issues: I). My smartphone can't scan a QR code. II). I get the following message after when a QR code is scanned: Android app: Please ask your admin if the error will be repeated: Device add error ios app: Error: JSONEmptyField, message: The field AddDeviceResult is an empty string Windows Phone app: Can't load the authenticator: Salt is null or empty Causes: I). The app supports only NetIQ Advanced Authentication compliant QR codes. The other QR codes can't be scanned with the NetIQ smartphone app. II) Incorrect configuration. Solution: I) 1. Ensure that you are trying to scan a QR code 1.1. In NetIQ Advanced Authentication Self-Service Portal for Smartphone or TOTP method. In case of TOTP method usage probably the Google Authenticator format of QR code is enabled. Contact your system administrator to check this In NetIQ Advanced Authentication Web Enrollment Wizard for for Smartphone or OATH OTP method (when TOTP mode is selected) Using Smartphone or OATH OTP method within a first logon on workstation or later in Authenticators Management. A QR code which is shown in OATH - Enroll window may be too small (depending on screen resolution). It's recommended to perform the enrollment through 43

44 the NetIQ Advanced Authentication Web Enrollment Wizard, because itshows the larger QR codes and the Web Enrollment Wizard improves the user's experience in OATH OTP authenticator enrollment. II) Administrator should verify correctness of Smartphone method configuration. This may be related to a conflict on IP address/port. Recommendations: I) a. Ensure that mouse cursor doesn't overlap the QR code. b. If you are enrolling the authenticator in browser try to zoom in the page with the QR code to %. It may be required for screens with high resolution. c. Try to enroll on another monitor (brightness, contrast, glossy surface may affect). d. Check on the smartphone that the QR code is in focus. Some Android devices has no autofocus feature and may have problems with scanning the QR codes. e. Try to use another smartphone. II) Contact your system administrator. 44

45 Authentication using NetIQ Smartphone Authenticator Fails Description: Authentication using with NetIQ Smartphone Authenticator fails. Causes: 1. There is no Internet connection on the Server with Smartphone authentication dispatcher. 2. The authentication timeout. Solution: 1. You can login with OTP that is automatically generated by NetIQ Smartphone Authenticator. 2. Request the authentication again. Do not wait for push notification. Open the app manually and accept the authentication request. 45

46 One-Time Password Doesn t Work Description: The generated one-time password doesn t work. Cause: a. There is a significant time drift between your smartphone and server. b. Authenticator is invalid or used not correctly. Solution: a. Ensure that a time on your smartphone is synced with a time server. Ensure that you have a valid time zone specified on your smartphone. b. Contact your system administrator. 46

Guide for Setting Up Your Multi-Factor Authentication Account and Using Multi-Factor Authentication This document serves as a How To reference guide for employees to execute the following MFA tasks: 1.

Guide for Setting Up Your Multi-Factor Authentication Account and Using Multi-Factor Authentication Mobile App Activation Before you can activate the mobile app you must download it. You can have up to

How can I protect against the loss of my if my device is lost or stolen? If your mobile device is stolen or lost, you can reactivate your user on a new device and deactivate it on your stolen or lost device.

As a courtesy to the Palm Beach County School District employees, the Division of IT is now providing District Google Mail access for personal mobile devices. Although we do not have the staffing to accept

Mechanics Bank Mobile Banking Mobile Finance Manager (MFM) Application Palm Treo Installation Thank you for your interest in Mechanics Bank Mobile Banking. This guide will help you get started with Mechanics

Document Conventions Our documents use certain types of document conventions to help you distinguish language elements from keyboard sequences, and so on. The following table clarifies the new conventions

Introduction Welcome to the Mount s Remote Access service. The following documentation is intended to assist first time or active users with connecting, authenticating and properly logging out of Remote

Sophos Mobile Control User guide for Android Product version: 4 Document date: May 2014 Contents 1 About Sophos Mobile Control...3 2 About this guide...4 3 Login to the Self Service Portal...5 4 Set up

Chapter 7 Managing policies You use the Policies tab in Admin Portal to create policy sets for roles. A policy set lets you configure the following categories of policies: Mobile Device Policies Use to

Two Factor Authentication Two Factor Authentication (TFA; 2FA) is a security process in which two methods of authentication are used to verify who you are. For example, one method currently utilized within

Qsync Qsync is a cloud based file synchronization service empowered by QNAP Turbo NAS. Simply add files to your local Qsync folder, and they will be available on your Turbo NAS and all its connected devices.

Health Science Center AirWatch Installation and Enrollment Instructions For Apple ios 8 Devices Following are the steps necessary to register and enroll an Apple ios 8 device with the University s AirWatch

www.novell.com/documentation User Guide Novell iprint 1.1 March 2015 Legal Notices Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and specifically

All students are REQUIRED to configure and maintain their mobile devices as outlined in this document. Non-compliance is a violation of District policy and may result in disciplinary action and/or revocation

Getting Started Getting Started MagicConnect is a remote access service that allows you safe remote access to a target device from your remote device. What is a remote device? It is a Windows device, iphone/ipad,

SJRWMD Cloud-Based Email Quick-Start Guide Your email account is now in the Microsoft cloud, also known as Office 365. This change from onpremise email provisioning to the cloud allows the agency to provide

Chapter 3 Using Devices es The Devices page lists all the devices you have enrolled in the Centrify identity platform and lets you send commands to the devices. Device related tasks that you can perform

Two Factor Authentication - USER GUIDE Two Factor Authentication (or 2FA) is a two step verification process that provides an extra layer of security for you when accessing your account within Online Services.

MobileMerchant Application Guide United Kingdom Ireland Version 6 Android: Google Play is a trademark of Google Inc. Apple: Apple, the Apple logo, iphone and ipad are trademarks of Apple Inc., registered

Business Mobile App User Guide Logging On to CNB Business Mobile Logging on to CNB Business Mobile involves the same layers of authentication as your Online For Business account does. 1. Launch the app

Store & Share Quick Start What is Store & Share? Store & Share is a service that allows you to upload all of your content (documents, music, video, executable files) into a centralized cloud storage. You

District 211 Technology ipad Setup Instructions Turn power on & Start Setup Hold down the power button to turn on your ipad. The power button is located on the top right edge of the ipad. Slide the slider

MC3WAVES Wireless Connection Wizard When viewing available wireless networks on either MCCC campus you will see a network named public. Connection to public is open to all. Upon connecting to the network